tools/testing/selftests/bpf/progs/xdp_flowtable.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #define BPF_NO_KFUNC_PROTOTYPES
   3 #include <vmlinux.h>
   4 #include <bpf/bpf_helpers.h>
   5 #include <bpf/bpf_endian.h>
   6
   7 #define ETH_P_IP        0x0800
   8 #define ETH_P_IPV6      0x86dd
   9 #define IP_MF           0x2000  /* "More Fragments" */
  10 #define IP_OFFSET       0x1fff  /* "Fragment Offset" */
  11 #define AF_INET         2
  12 #define AF_INET6        10
  13
  14 struct bpf_flowtable_opts___local {
  15         s32 error;
  16 };
  17
  18 struct flow_offload_tuple_rhash *
  19 bpf_xdp_flow_lookup(struct xdp_md *, struct bpf_fib_lookup *,
  20                     struct bpf_flowtable_opts___local *, u32) __ksym;
  21
  22 struct {
  23         __uint(type, BPF_MAP_TYPE_ARRAY);
  24         __type(key, __u32);
  25         __type(value, __u32);
  26         __uint(max_entries, 1);
  27 } stats SEC(".maps");
  28
  29 static bool xdp_flowtable_offload_check_iphdr(struct iphdr *iph)
  30 {
  31         /* ip fragmented traffic */
  32         if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET))
  33                 return false;
  34
  35         /* ip options */
  36         if (iph->ihl * 4 != sizeof(*iph))
  37                 return false;
  38
  39         if (iph->ttl <= 1)
  40                 return false;
  41
  42         return true;
  43 }
  44
  45 static bool xdp_flowtable_offload_check_tcp_state(void *ports, void *data_end,
  46                                                   u8 proto)
  47 {
  48         if (proto == IPPROTO_TCP) {
  49                 struct tcphdr *tcph = ports;
  50
  51                 if (tcph + 1 > data_end)
  52                         return false;
  53
  54                 if (tcph->fin || tcph->rst)
  55                         return false;
  56         }
  57
  58         return true;
  59 }
  60
  61 struct flow_ports___local {
  62         __be16 source, dest;
  63 } __attribute__((preserve_access_index));
  64
  65 SEC("xdp.frags")
  66 int xdp_flowtable_do_lookup(struct xdp_md *ctx)
  67 {
  68         void *data_end = (void *)(long)ctx->data_end;
  69         struct bpf_flowtable_opts___local opts = {};
  70         struct flow_offload_tuple_rhash *tuplehash;
  71         struct bpf_fib_lookup tuple = {
  72                 .ifindex = ctx->ingress_ifindex,
  73         };
  74         void *data = (void *)(long)ctx->data;
  75         struct ethhdr *eth = data;
  76         struct flow_ports___local *ports;
  77         __u32 *val, key = 0;
  78
  79         if (eth + 1 > data_end)
  80                 return XDP_DROP;
  81
  82         switch (eth->h_proto) {
  83         case bpf_htons(ETH_P_IP): {
  84                 struct iphdr *iph = data + sizeof(*eth);
  85
  86                 ports = (struct flow_ports___local *)(iph + 1);
  87                 if (ports + 1 > data_end)
  88                         return XDP_PASS;
  89
  90                 /* sanity check on ip header */
  91                 if (!xdp_flowtable_offload_check_iphdr(iph))
  92                         return XDP_PASS;
  93
  94                 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
  95                                                            iph->protocol))
  96                         return XDP_PASS;
  97
  98                 tuple.family            = AF_INET;
  99                 tuple.tos               = iph->tos;
 100                 tuple.l4_protocol       = iph->protocol;
 101                 tuple.tot_len           = bpf_ntohs(iph->tot_len);
 102                 tuple.ipv4_src          = iph->saddr;
 103                 tuple.ipv4_dst          = iph->daddr;
 104                 tuple.sport             = ports->source;
 105                 tuple.dport             = ports->dest;
 106                 break;
 107         }
 108         case bpf_htons(ETH_P_IPV6): {
 109                 struct in6_addr *src = (struct in6_addr *)tuple.ipv6_src;
 110                 struct in6_addr *dst = (struct in6_addr *)tuple.ipv6_dst;
 111                 struct ipv6hdr *ip6h = data + sizeof(*eth);
 112
 113                 ports = (struct flow_ports___local *)(ip6h + 1);
 114                 if (ports + 1 > data_end)
 115                         return XDP_PASS;
 116
 117                 if (ip6h->hop_limit <= 1)
 118                         return XDP_PASS;
 119
 120                 if (!xdp_flowtable_offload_check_tcp_state(ports, data_end,
 121                                                            ip6h->nexthdr))
 122                         return XDP_PASS;
 123
 124                 tuple.family            = AF_INET6;
 125                 tuple.l4_protocol       = ip6h->nexthdr;
 126                 tuple.tot_len           = bpf_ntohs(ip6h->payload_len);
 127                 *src                    = ip6h->saddr;
 128                 *dst                    = ip6h->daddr;
 129                 tuple.sport             = ports->source;
 130                 tuple.dport             = ports->dest;
 131                 break;
 132         }
 133         default:
 134                 return XDP_PASS;
 135         }
 136
 137         tuplehash = bpf_xdp_flow_lookup(ctx, &tuple, &opts, sizeof(opts));
 138         if (!tuplehash)
 139                 return XDP_PASS;
 140
 141         val = bpf_map_lookup_elem(&stats, &key);
 142         if (val)
 143                 __sync_add_and_fetch(val, 1);
 144
 145         return XDP_PASS;
 146 }
 147
 148 char _license[] SEC("license") = "GPL";